From 77c4ac68f6de2c28759b3ab6ea7b38d3a75d4e42 Mon Sep 17 00:00:00 2001 From: david-parker-softrams <138718581+david-parker-softrams@users.noreply.github.com> Date: Wed, 22 Oct 2025 15:09:04 -0400 Subject: [PATCH 1/9] Fixing hook issues --- hooks/detect_hardcoded_urls.py | 17 ++++++++++------- hooks/genai_security_check.py | 28 ++++++++++++++++++++++++++++ 2 files changed, 38 insertions(+), 7 deletions(-) diff --git a/hooks/detect_hardcoded_urls.py b/hooks/detect_hardcoded_urls.py index 071e6e7..55b1cea 100755 --- a/hooks/detect_hardcoded_urls.py +++ b/hooks/detect_hardcoded_urls.py @@ -17,8 +17,10 @@ r'ftp://[^\s\'">\]]+', # Database connection strings with URLs r'(?:jdbc|mongodb|mysql|postgresql)://[^\s\'">\]]+', - # API endpoints patterns - r'(?:api\.|www\.)[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}(?:/[^\s\'">\]]*)?', + # API endpoints patterns (more specific to avoid overlap with documentation URLs) + r'api\.[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}(?:/[^\s\'">\]]*)?', + # Suspicious www domains (exclude common safe ones) + r'www\.(?!(?:w3\.org|github\.com|docs\.|example\.(?:com|org|net)|.*\.example\.(?:com|org|net)))[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}(?:/[^\s\'">\]]*)?', ] # URLs that are typically safe to ignore @@ -33,11 +35,12 @@ r'https?://.*\.test', r'https?://.*\.local', r'https?://.*\.localhost', + r'https?://mock-host/.*?', # Common documentation URLs - r'https?://github\.com/.*', + r'https?://(?:www\.)?github\.com(?:/.*)?', r'https?://docs\..*', - r'https?://www\.w3\.org/.*', - r'https?://tools\.ietf\.org/.*', + r'https?://www\.w3\.org(?:/.*)?', + r'https?://tools\.ietf\.org(?:/.*)?', r'https?://schemas\..*', # Package registries r'https?://registry\.npmjs\.org/.*', @@ -46,7 +49,7 @@ ] # File extensions to skip -SKIP_EXTENSIONS = {'.png', '.jpg', '.jpeg', '.gif', '.ico', '.svg', '.pdf', '.zip', '.tar', '.gz'} +SKIP_EXTENSIONS = {'.png', '.jpg', '.jpeg', '.gif', '.ico', '.svg', '.pdf', '.zip', '.tar', '.gz' '.md'} # Patterns that suggest this might be in a comment or documentation COMMENT_PATTERNS = [ @@ -65,7 +68,7 @@ def is_in_comment(line: str) -> bool: def is_safe_url(url: str) -> bool: """Check if URL matches safe patterns.""" - return any(re.match(pattern, url, re.IGNORECASE) for pattern in SAFE_URL_PATTERNS) + return any(re.fullmatch(pattern, url, re.IGNORECASE) for pattern in SAFE_URL_PATTERNS) def find_hardcoded_urls(file_path: str) -> List[Tuple[int, str, str]]: diff --git a/hooks/genai_security_check.py b/hooks/genai_security_check.py index fa93c13..6c80164 100755 --- a/hooks/genai_security_check.py +++ b/hooks/genai_security_check.py @@ -59,10 +59,17 @@ }, 'weak_crypto': { 'patterns': [ +<<<<<<< HEAD r'MD5', r'SHA1\b', r'\bDES\b', r'RC4', +======= + r'\bMD5\b', + r'\bSHA1\b', + r'\bDES\b', + r'\bRC4\b', +>>>>>>> ef03289 (Adding support for javascript multi-line import{...}from syntax) r'\.md5\(', r'\.sha1\(', r'createHash\(["\']md5["\']', @@ -216,8 +223,29 @@ def check_genai_patterns(file_path: str) -> List[Tuple[int, str, str, str]]: if not line.strip(): continue + # Check if line is an import statement + stripped_line = line.strip() + is_import_line = ( + stripped_line.startswith('import ') or + stripp*ed_line.startswith('from ') or + re.match(r'^\s*import\s+', line) or + re.match(r'^\s*}?\s*from\s+', line) or + re.match(r'^\s*#include\s*<', line) or # C/C++ + re.match(r'^\s*#include\s*"', line) or # C/C++ + re.match(r'^\s*using\s+', line) or # C#/Java + re.match(r'^\s*require\s*\(', line) or # JavaScript/Node.js + re.match(r'^\s*const\s+.*\s*=\s*require\s*\(', line) or # JavaScript/Node.js + re.match(r'^\s*let\s+.*\s*=\s*require\s*\(', line) or # JavaScript/Node.js + re.match(r'^\s*var\s+.*\s*=\s*require\s*\(', line) or # JavaScript/Node.js + re.match(r'^\s*import\s+.*\s+from\s+', line) # ES6 imports + ) + # Check security patterns for pattern_name, pattern_info in GENAI_SECURITY_PATTERNS.items(): + # Skip path traversal checks for import lines + if pattern_name == 'path_traversal' and is_import_line: + continue + for pattern in pattern_info['patterns']: if re.search(pattern, line, re.IGNORECASE): issues.append(( From cdc75900bcecc09a41616787ce8e1b74b4e45805 Mon Sep 17 00:00:00 2001 From: david-parker-softrams <138718581+david-parker-softrams@users.noreply.github.com> Date: Wed, 22 Oct 2025 15:18:01 -0400 Subject: [PATCH 2/9] Bump version --- README.md | 22 +++++++++++----------- examples/ansible-project.yaml | 4 ++-- examples/dotnet-project.yaml | 4 ++-- examples/full-stack.yaml | 4 ++-- examples/go-project.yaml | 4 ++-- examples/infrastructure.yaml | 4 ++-- examples/java-project.yaml | 4 ++-- examples/minimal-security.yaml | 4 ++-- examples/nodejs-react.yaml | 4 ++-- examples/python-project.yaml | 4 ++-- hooks/__init__.py | 2 +- pyproject.toml | 2 +- 12 files changed, 31 insertions(+), 31 deletions(-) diff --git a/README.md b/README.md index 156c0c3..8ffba34 100644 --- a/README.md +++ b/README.md @@ -69,7 +69,7 @@ Create a `.pre-commit-config.yaml` file in your project root: ```yaml repos: - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 + rev: v1.1.6 hooks: # Security hooks (recommended for all projects) - id: detect_secrets @@ -176,7 +176,7 @@ For projects using GenAI tools, start with these essential security hooks: ```yaml repos: - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 + rev: v1.1.6 hooks: - id: detect_secrets - id: hardcoded_credentials @@ -193,7 +193,7 @@ repos: ```yaml repos: - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 + rev: v1.1.6 hooks: # Security - id: detect_secrets @@ -223,7 +223,7 @@ repos: ```yaml repos: - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 + rev: v1.1.6 hooks: # Security - id: detect_secrets @@ -251,7 +251,7 @@ repos: ```yaml repos: - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 + rev: v1.1.6 hooks: # Security - id: detect_secrets @@ -280,7 +280,7 @@ repos: ```yaml repos: - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 + rev: v1.1.6 hooks: # Security - id: detect_secrets @@ -307,7 +307,7 @@ repos: ```yaml repos: - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 + rev: v1.1.6 hooks: # Security - id: detect_secrets @@ -334,7 +334,7 @@ repos: ```yaml repos: - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 + rev: v1.1.6 hooks: # Security - id: detect_secrets @@ -360,7 +360,7 @@ repos: ```yaml repos: - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 + rev: v1.1.6 hooks: # Security - id: detect_secrets @@ -388,7 +388,7 @@ repos: ```yaml repos: - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 + rev: v1.1.6 hooks: # Security (essential for GenAI projects) - id: detect_secrets @@ -677,7 +677,7 @@ For large repositories: ```yaml repos: - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 + rev: v1.1.6 hooks: - id: detect_secrets exclude: ^(docs/|tests/fixtures/) diff --git a/examples/ansible-project.yaml b/examples/ansible-project.yaml index da70ff7..7e0efeb 100644 --- a/examples/ansible-project.yaml +++ b/examples/ansible-project.yaml @@ -2,8 +2,8 @@ # Setup for Ansible playbooks and roles with security focus repos: - - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 # Use the latest version + - repo: https://github.com/david-parker-softrams/pre-commit-library + rev: v1.1.6 # Use the latest version hooks: # Security hooks (essential for GenAI projects) - id: detect_secrets diff --git a/examples/dotnet-project.yaml b/examples/dotnet-project.yaml index 376575b..5e6c79e 100644 --- a/examples/dotnet-project.yaml +++ b/examples/dotnet-project.yaml @@ -2,8 +2,8 @@ # Setup for C#, VB.NET, and F# development with security focus repos: - - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 # Use the latest version + - repo: https://github.com/david-parker-softrams/pre-commit-library + rev: v1.1.6 # Use the latest version hooks: # Security hooks (essential for GenAI projects) - id: detect_secrets diff --git a/examples/full-stack.yaml b/examples/full-stack.yaml index 35d7333..740a492 100644 --- a/examples/full-stack.yaml +++ b/examples/full-stack.yaml @@ -2,8 +2,8 @@ # Comprehensive setup for projects with multiple languages and technologies repos: - - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 # Use the latest version + - repo: https://github.com/david-parker-softrams/pre-commit-library + rev: v1.1.6 # Use the latest version hooks: # Security hooks (essential for ALL GenAI projects) - id: detect_secrets diff --git a/examples/go-project.yaml b/examples/go-project.yaml index af68b23..457d8a1 100644 --- a/examples/go-project.yaml +++ b/examples/go-project.yaml @@ -2,8 +2,8 @@ # Setup for Go development with security focus repos: - - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 # Use the latest version + - repo: https://github.com/david-parker-softrams/pre-commit-library + rev: v1.1.6 # Use the latest version hooks: # Security hooks (essential for GenAI projects) - id: detect_secrets diff --git a/examples/infrastructure.yaml b/examples/infrastructure.yaml index 697130a..02ce40d 100644 --- a/examples/infrastructure.yaml +++ b/examples/infrastructure.yaml @@ -2,8 +2,8 @@ # Setup for Terraform, CloudFormation, and Docker with security focus repos: - - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 # Use the latest version + - repo: https://github.com/david-parker-softrams/pre-commit-library + rev: v1.1.6 # Use the latest version hooks: # Security hooks (essential for GenAI projects) - id: detect_secrets diff --git a/examples/java-project.yaml b/examples/java-project.yaml index b298ae4..a1af909 100644 --- a/examples/java-project.yaml +++ b/examples/java-project.yaml @@ -2,8 +2,8 @@ # Setup for Java development with security focus repos: - - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 # Use the latest version + - repo: https://github.com/david-parker-softrams/pre-commit-library + rev: v1.1.6 # Use the latest version hooks: # Security hooks (essential for GenAI projects) - id: detect_secrets diff --git a/examples/minimal-security.yaml b/examples/minimal-security.yaml index 3636c49..03546c0 100644 --- a/examples/minimal-security.yaml +++ b/examples/minimal-security.yaml @@ -2,8 +2,8 @@ # Essential hooks for protecting against accidental credential/secret commits repos: - - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 # Use the latest version + - repo: https://github.com/david-parker-softrams/pre-commit-library + rev: v1.1.6 # Use the latest version hooks: # Critical security hooks for GenAI-generated code - id: detect_secrets diff --git a/examples/nodejs-react.yaml b/examples/nodejs-react.yaml index 119343d..aafe660 100644 --- a/examples/nodejs-react.yaml +++ b/examples/nodejs-react.yaml @@ -2,8 +2,8 @@ # Setup for JavaScript/TypeScript development with security focus repos: - - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 # Use the latest version + - repo: https://github.com/david-parker-softrams/pre-commit-library + rev: v1.1.6 # Use the latest version hooks: # Security hooks (essential for GenAI projects) - id: detect_secrets diff --git a/examples/python-project.yaml b/examples/python-project.yaml index 26bb7fc..df57a45 100644 --- a/examples/python-project.yaml +++ b/examples/python-project.yaml @@ -2,8 +2,8 @@ # Comprehensive setup for Python development with security focus repos: - - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 # Use the latest version + - repo: https://github.com/david-parker-softrams/pre-commit-library + rev: v1.1.6 # Use the latest version hooks: # Security hooks (essential for GenAI projects) - id: detect_secrets diff --git a/hooks/__init__.py b/hooks/__init__.py index 1dfa7ea..44c3b1e 100644 --- a/hooks/__init__.py +++ b/hooks/__init__.py @@ -6,7 +6,7 @@ and other GenAI assistants. """ -__version__ = "1.1.5" +__version__ = "1.1.6" __author__ = "TriaFed" __email__ = "info@triafed.com" __description__ = "Pre-commit hooks library for GenAI code validation and security" diff --git a/pyproject.toml b/pyproject.toml index 72d9462..23501a2 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta" [project] name = "pre-commit-hooks-genai" -version = "1.1.5" +version = "1.1.6" description = "Pre-commit hooks library for GenAI code validation and security" readme = "README.md" license = {text = "MIT"} From 332b46b0b6589453d16a3de412b9ad533bc38df5 Mon Sep 17 00:00:00 2001 From: david-parker-softrams <138718581+david-parker-softrams@users.noreply.github.com> Date: Wed, 22 Oct 2025 15:19:50 -0400 Subject: [PATCH 3/9] Update hooks/genai_security_check.py Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- hooks/genai_security_check.py | 7 ------- 1 file changed, 7 deletions(-) diff --git a/hooks/genai_security_check.py b/hooks/genai_security_check.py index 6c80164..96bd1ec 100755 --- a/hooks/genai_security_check.py +++ b/hooks/genai_security_check.py @@ -59,17 +59,10 @@ }, 'weak_crypto': { 'patterns': [ -<<<<<<< HEAD - r'MD5', - r'SHA1\b', - r'\bDES\b', - r'RC4', -======= r'\bMD5\b', r'\bSHA1\b', r'\bDES\b', r'\bRC4\b', ->>>>>>> ef03289 (Adding support for javascript multi-line import{...}from syntax) r'\.md5\(', r'\.sha1\(', r'createHash\(["\']md5["\']', From e99fd09ee2d99f7626168b89c0e30f80923da496 Mon Sep 17 00:00:00 2001 From: david-parker-softrams <138718581+david-parker-softrams@users.noreply.github.com> Date: Wed, 22 Oct 2025 15:20:08 -0400 Subject: [PATCH 4/9] Update hooks/genai_security_check.py Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- hooks/genai_security_check.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hooks/genai_security_check.py b/hooks/genai_security_check.py index 96bd1ec..e627b2b 100755 --- a/hooks/genai_security_check.py +++ b/hooks/genai_security_check.py @@ -220,7 +220,7 @@ def check_genai_patterns(file_path: str) -> List[Tuple[int, str, str, str]]: stripped_line = line.strip() is_import_line = ( stripped_line.startswith('import ') or - stripp*ed_line.startswith('from ') or + stripped_line.startswith('from ') or re.match(r'^\s*import\s+', line) or re.match(r'^\s*}?\s*from\s+', line) or re.match(r'^\s*#include\s*<', line) or # C/C++ From 2939cebf97332ea59fef8e3f81a8f99351e9c43e Mon Sep 17 00:00:00 2001 From: david-parker-softrams <138718581+david-parker-softrams@users.noreply.github.com> Date: Wed, 22 Oct 2025 15:20:25 -0400 Subject: [PATCH 5/9] Update hooks/detect_hardcoded_urls.py Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- hooks/detect_hardcoded_urls.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hooks/detect_hardcoded_urls.py b/hooks/detect_hardcoded_urls.py index 55b1cea..b870fb6 100755 --- a/hooks/detect_hardcoded_urls.py +++ b/hooks/detect_hardcoded_urls.py @@ -49,7 +49,7 @@ ] # File extensions to skip -SKIP_EXTENSIONS = {'.png', '.jpg', '.jpeg', '.gif', '.ico', '.svg', '.pdf', '.zip', '.tar', '.gz' '.md'} +SKIP_EXTENSIONS = {'.png', '.jpg', '.jpeg', '.gif', '.ico', '.svg', '.pdf', '.zip', '.tar', '.gz', '.md'} # Patterns that suggest this might be in a comment or documentation COMMENT_PATTERNS = [ From 711bf0e6bcc9ddae1f09342a1cbd5533666f1ad0 Mon Sep 17 00:00:00 2001 From: david-parker-softrams <138718581+david-parker-softrams@users.noreply.github.com> Date: Wed, 22 Oct 2025 15:29:09 -0400 Subject: [PATCH 6/9] Update hooks/genai_security_check.py Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- hooks/genai_security_check.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/hooks/genai_security_check.py b/hooks/genai_security_check.py index e627b2b..66e1f1e 100755 --- a/hooks/genai_security_check.py +++ b/hooks/genai_security_check.py @@ -219,8 +219,6 @@ def check_genai_patterns(file_path: str) -> List[Tuple[int, str, str, str]]: # Check if line is an import statement stripped_line = line.strip() is_import_line = ( - stripped_line.startswith('import ') or - stripped_line.startswith('from ') or re.match(r'^\s*import\s+', line) or re.match(r'^\s*}?\s*from\s+', line) or re.match(r'^\s*#include\s*<', line) or # C/C++ From bb9f4b946824dba671de33cf615802741542feda Mon Sep 17 00:00:00 2001 From: david-parker-softrams <138718581+david-parker-softrams@users.noreply.github.com> Date: Wed, 22 Oct 2025 15:29:41 -0400 Subject: [PATCH 7/9] Update hooks/detect_hardcoded_urls.py Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- hooks/detect_hardcoded_urls.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hooks/detect_hardcoded_urls.py b/hooks/detect_hardcoded_urls.py index b870fb6..ef1cbec 100755 --- a/hooks/detect_hardcoded_urls.py +++ b/hooks/detect_hardcoded_urls.py @@ -35,7 +35,7 @@ r'https?://.*\.test', r'https?://.*\.local', r'https?://.*\.localhost', - r'https?://mock-host/.*?', + r'https?://mock-host/.*', # Common documentation URLs r'https?://(?:www\.)?github\.com(?:/.*)?', r'https?://docs\..*', From 7526419f115d50010e234ce853b52cfe436465a0 Mon Sep 17 00:00:00 2001 From: david-parker-softrams <138718581+david-parker-softrams@users.noreply.github.com> Date: Wed, 22 Oct 2025 15:59:09 -0400 Subject: [PATCH 8/9] Reverting back to match instead of fullmatch in URL safecheck --- hooks/detect_hardcoded_urls.py | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/hooks/detect_hardcoded_urls.py b/hooks/detect_hardcoded_urls.py index ef1cbec..8629d11 100755 --- a/hooks/detect_hardcoded_urls.py +++ b/hooks/detect_hardcoded_urls.py @@ -25,22 +25,22 @@ # URLs that are typically safe to ignore SAFE_URL_PATTERNS = [ - r'https?://localhost', - r'https?://127\.0\.0\.1', - r'https?://0\.0\.0\.0', - r'https?://example\.com', - r'https?://example\.org', - r'https?://example\.net', - r'https?://.*\.example\.com', - r'https?://.*\.test', - r'https?://.*\.local', - r'https?://.*\.localhost', + r'https?://localhost(?:[:/].*)?', + r'https?://127\.0\.0\.1(?:[:/].*)?', + r'https?://0\.0\.0\.0(?:[:/].*)?', + r'https?://example\.com(?:[/?#].*)?', + r'https?://example\.org(?:[/?#].*)?', + r'https?://example\.net(?:[/?#].*)?', + r'https?://.*\.example\.com(?:[/?#].*)?', + r'https?://.*\.test(?:[/?#].*)?', + r'https?://.*\.local(?:[/?#].*)?', + r'https?://.*\.localhost(?:[/?#].*)?', r'https?://mock-host/.*', # Common documentation URLs - r'https?://(?:www\.)?github\.com(?:/.*)?', + r'https?://(?:www\.)?github\.com(?:[/?#].*)?', r'https?://docs\..*', - r'https?://www\.w3\.org(?:/.*)?', - r'https?://tools\.ietf\.org(?:/.*)?', + r'https?://www\.w3\.org(?:[/?#].*)?', + r'https?://tools\.ietf\.org(?:[/?#].*)?', r'https?://schemas\..*', # Package registries r'https?://registry\.npmjs\.org/.*', @@ -68,7 +68,7 @@ def is_in_comment(line: str) -> bool: def is_safe_url(url: str) -> bool: """Check if URL matches safe patterns.""" - return any(re.fullmatch(pattern, url, re.IGNORECASE) for pattern in SAFE_URL_PATTERNS) + return any(re.match(pattern + r'$', url, re.IGNORECASE) for pattern in SAFE_URL_PATTERNS) def find_hardcoded_urls(file_path: str) -> List[Tuple[int, str, str]]: From cd72c5ee03ec7d0e81f573e56f7647917033e73d Mon Sep 17 00:00:00 2001 From: david-parker-softrams <138718581+david-parker-softrams@users.noreply.github.com> Date: Thu, 23 Oct 2025 15:08:14 -0400 Subject: [PATCH 9/9] Fixes --- hooks/genai_security_check.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hooks/genai_security_check.py b/hooks/genai_security_check.py index 66e1f1e..ddaa7cc 100755 --- a/hooks/genai_security_check.py +++ b/hooks/genai_security_check.py @@ -219,6 +219,8 @@ def check_genai_patterns(file_path: str) -> List[Tuple[int, str, str, str]]: # Check if line is an import statement stripped_line = line.strip() is_import_line = ( + # stripped_line.startswith('import ') or + # stripped_line.startswith('from ') or re.match(r'^\s*import\s+', line) or re.match(r'^\s*}?\s*from\s+', line) or re.match(r'^\s*#include\s*<', line) or # C/C++